Privacy Policy
Last updated 24 August 2026
Tracked Money is an information product. It reads disclosures that are already public — congressional periodic transaction reports, SEC Form 4s and 13Fs, federal contract awards — and tells you when something you follow appears in one. It does not connect to a brokerage, hold money, or place trades.
This policy covers the Tracked Money mobile app and this website. It is written to be read, not to be survived, so the plain-language answer comes first in every section.
The short version
- We store your email address, because that is how you sign in.
- We store who and what you follow, because that is the product.
- We store a push token if you allow notifications, so alerts can reach your device.
- We do not sell your data, and there is no advertising or cross-app tracking.
- You can delete everything from inside the app, in Settings → Delete account.
1. Who is responsible for your data
The controller is [LEGAL NAME] Ltd, registered in England and Wales. For any privacy question or request, contact [email protected].
2. What we collect, and why
Everything below is collected because a specific feature needs it. Nothing is collected speculatively.
| Data | Why | Basis |
|---|---|---|
| Email address | Sign-in. We email a one-time code; there is no password. | Performance of a contract |
| One-time sign-in codes | Verifying it is you. Stored hashed, expire after 15 minutes, deleted on use. | Performance of a contract |
| Filers and strategies you follow | Building your feed and deciding which alerts are yours. | Performance of a contract |
| Tickers on your watchlist | Alerting you when smart money touches a stock you watch. | Performance of a contract |
| Push token | Delivering alerts. Only stored if you grant notification permission. | Consent |
| Notification settings | Mutes, conviction thresholds and quiet hours, per filer. | Performance of a contract |
| Which alerts you have read | So the inbox knows what is new. Deleted automatically after 90 days. | Legitimate interest |
| Subscription status | Knowing whether you are on the free or paid tier. | Performance of a contract |
| Telegram chat ID | Only if you deliberately connect Telegram for alerts. | Consent |
| Referral code | Attributing invitations. | Legitimate interest |
Website analytics
We count page views and clicks on this website in our own database, so we know whether anyone is reading it. Those records hold no IP address, no user agent, no cookie and no visitor identifier — only a path, the referring site's domain, any campaign tag, and the day. They are not linked to your account and cannot identify you. They are deleted after 180 days. Because nothing personal is stored, there is no tracking cookie and no consent banner.
App analytics and crash reporting
With your permission, the Tracked Money app uses Google Firebase Analytics and Firebase Crashlytics to understand which features are used and to diagnose crashes. This is off until you choose "Allow" in the app, and you can switch it off at any time in Settings › Privacy › "Share anonymous usage & crash data". Switching it off also deletes analytics data and unsent crash reports stored on your device.
When enabled, we collect app usage events (for example screens viewed, filers followed or unfollowed, subscription screens viewed and purchases started or completed), device and app information (device model, operating system, app version, country derived from IP address) and crash diagnostics (stack traces and device state at the time of a crash). Events are associated with a random internal account identifier. We never send your email address, search text or any advertising identifier to Firebase; we do not collect the Apple IDFA, the Android Advertising ID or the device vendor ID; and we do not use this data for advertising or share it with advertisers or ad networks.
Our lawful basis is your consent (UK GDPR Art. 6(1)(a) and PECR regulation 6). Google processes this data on our behalf as a processor and may transfer it to the United States under appropriate safeguards (the UK International Data Transfer Addendum / Standard Contractual Clauses). Analytics data is kept for 14 months and crash reports for 90 days.
Launch waitlist
If you leave your email address on our coming-soon page, we store that address and the date you left it, and use it only to email you when the app launches. Our lawful basis is your consent (UK GDPR Art. 6(1)(a)). We delete the list after the launch email has been sent, or sooner if you ask us to at [email protected].
What we deliberately do not collect
- No brokerage credentials. Tracked Money cannot connect to a broker, by design.
- No payment card details. Payment is handled entirely by Apple or Google; we never see a card number.
- No contacts, photos, microphone, or precise location.
- No advertising identifiers, and no tracking across other apps or websites.
3. Who processes it with us
Tracked Money uses a small number of third parties to operate. Each receives only what its job requires, and each has its own privacy policy governing what it does with it.
| Processor | What it receives | Why |
|---|---|---|
| Google (Firebase Analytics, Crashlytics) — only if you allow it | App usage events, device and app information, crash reports, a random account identifier | Understanding feature use and fixing crashes |
| Expo (Expo Application Services) | Push token, notification content | Delivering push notifications |
| Apple / Google | Purchase and subscription events | Processing payment; they are the merchant of record |
| RevenueCat, Inc. | An anonymous account identifier, purchase events | Validating subscriptions across platforms |
| Resend, or SendGrid | Your email address, the one-time code | Delivering sign-in codes. Whichever is configured; Resend is used by preference. |
| Sentry | Crash and error diagnostics | Finding and fixing faults |
| DigitalOcean | All of the above, at rest | Hosting the servers and database |
| Telegram | Your chat ID and alert content | Only if you connect Telegram yourself |
We do not sell personal data, and we do not share it for advertising or for anyone else's marketing.
4. Automated analysis
Tracked Money uses language models to read filings and summarise market signals. Those models are given public filing data — a disclosure form, a ticker, an amount. They are not given your email, your follows, or anything else that identifies you, and they are not used to make decisions about you.
5. How long we keep it
- Account data — until you delete your account.
- Launch waitlist addresses — until the launch email is sent, then deleted.
- Sign-in codes — 15 minutes, or until used.
- Read state — 90 days, then removed automatically.
- Purchase records — retained after account deletion where we are legally required to keep financial records. Once the account is gone, these no longer identify you.
- Filing data — indefinitely. It is public record and is not about you.
6. Deleting your account
In the app: Settings → Delete account. It is immediate and permanent. It removes your account, your follows, your watchlist, your notification settings, your push tokens and your read state. There is no recovery, and no soft-delete.
Deleting your account does not cancel your subscription
Subscriptions are billed by Apple or Google, not by us, and we cannot cancel one on your behalf. Cancel it first in your App Store or Google Play account settings, then delete your account. See Support.
You can also request deletion from the web.
7. Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you
- Correct anything inaccurate
- Delete it — available directly in the app, as above
- Receive a copy in a portable format
- Object to, or restrict, certain processing
- Withdraw consent — for example by turning off notifications
To exercise any of these, email [email protected]. We aim to respond within 30 days. If you are in the UK or EU and are unhappy with our response, you can complain to your local data protection authority.
If you are in California
Under the CCPA/CPRA you have the right to know what personal information we collect and why, to request deletion, to correct inaccurate information, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined by the CCPA, and we have not done so in the preceding twelve months. To exercise any of these rights, use the in-app deletion described above or email [email protected].
If you are in the UK or EU
You may lodge a complaint with your supervisory authority. In the UK that is the Information Commissioner's Office (ico.org.uk); in the EU it is the authority for your country of residence. We would rather you came to us first, but that right is yours regardless.
8. Security
- All traffic is encrypted in transit with HTTPS/TLS.
- Sign-in codes are stored hashed with bcrypt, never in plain text.
- Sessions use signed tokens: the access token lasts 15 minutes, the refresh token 30 days. There is no password to steal.
- The database is not reachable from the public internet.
No system is perfectly secure. If you believe you have found a vulnerability, please email [email protected] rather than disclosing it publicly.
If a breach occurs that is likely to put your rights at risk, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and notify you without undue delay where the law requires it.
9. Children
Tracked Money is not directed at children and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will remove it.
10. International transfers
Our servers and several processors are in the United States. If you are outside the US, your data is transferred there and protected by appropriate safeguards, including standard contractual clauses where required.
11. Changes
If this policy changes materially we will update the date at the top and notify you in the app before the change takes effect.
12. Contact
[LEGAL NAME] Ltd, England and Wales — [email protected]